Description

Detects AWS CloudFormation templates containing IAM policies that grant overly permissive access to AWS Systems Manager (SSM). Policies with wildcard actions (*) on SSM resources represent a security risk by potentially allowing unrestricted access to sensitive system management functions.

Detection Strategy

• Scans CloudFormation template files for IAM policy resources

• Identifies policy statements that include SSM-related permissions

• Reports a vulnerability when wildcards (*) are used to grant full access to SSM actions

• Examines both resource-level and action-level permissions in the IAM policies

Vulnerable code example

Resources:
  MyPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: VulnerablePolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:...

✅ Secure code example

Parameters:
  AllowedSSMPath:
    Type: String
    Default: /app/prod/*
    Description: SSM Parameter path that can be accessed

Resources:
  MyPolicy:...